diff --git a/docs/src/main/ruby/generate_readme.sh b/docs/src/main/ruby/generate_readme.sh index 7784d1d..6d0ce9d 100755 --- a/docs/src/main/ruby/generate_readme.sh +++ b/docs/src/main/ruby/generate_readme.sh @@ -16,9 +16,16 @@ end file = ARGV[0] if ARGV.length>0 -srcDir = File.dirname(file) -out = "// Do not edit this file (e.g. go instead to docs/src/main/asciidoc)\n\n" -doc = Asciidoctor.load_file file, safe: :safe, parse: false, attributes: 'allow-uri-read' +# Copied from https://github.com/asciidoctor/asciidoctor-extensions-lab/blob/master/scripts/asciidoc-coalescer.rb +doc = Asciidoctor.load_file file, safe: :unsafe, header_only: true, attributes: options[:attributes] +header_attr_names = (doc.instance_variable_get :@attributes_modified).to_a +header_attr_names.each {|k| doc.attributes[%(#{k}!)] = '' unless doc.attr? k } +attrs = doc.attributes +attrs['allow-uri-read'] = true +puts attrs + +out = "// Do not edit this file (e.g. go instead to src/main/asciidoc)\n\n" +doc = Asciidoctor.load_file file, safe: :unsafe, parse: false, attributes: attrs out << doc.reader.read unless options[:to_file] diff --git a/spring-cloud-cloudfoundry-discovery/src/main/asciidoc/README.adoc b/spring-cloud-cloudfoundry-discovery/src/main/asciidoc/README.adoc deleted file mode 100644 index 28c40fb..0000000 --- a/spring-cloud-cloudfoundry-discovery/src/main/asciidoc/README.adoc +++ /dev/null @@ -1,2 +0,0 @@ -include::intro.adoc[] - diff --git a/spring-cloud-cloudfoundry-discovery/src/main/asciidoc/ghpages.sh b/spring-cloud-cloudfoundry-discovery/src/main/asciidoc/ghpages.sh deleted file mode 100755 index 67da0d2..0000000 --- a/spring-cloud-cloudfoundry-discovery/src/main/asciidoc/ghpages.sh +++ /dev/null @@ -1,46 +0,0 @@ -#!/bin/bash -x - -git remote set-url --push origin `git config remote.origin.url | sed -e 's/^git:/https:/'` - -if ! (git remote set-branches --add origin gh-pages && git fetch -q); then - echo "No gh-pages, so not syncing" - exit 0 -fi - -if ! [ -d target/generated-docs ]; then - echo "No gh-pages sources in target/generated-docs, so not syncing" - exit 0 -fi - -# Stash any outstanding changes -################################################################### -git diff-index --quiet HEAD -dirty=$? -if [ "$dirty" != "0" ]; then git stash; fi - -# Switch to gh-pages branch to sync it with master -################################################################### -git checkout gh-pages - -for f in target/generated-docs/*; do - file=${f#target/generated-docs/*} - if ! git ls-files -i -o --exclude-standard --directory | grep -q ^$file$; then - # Not ignored... - cp -rf $f . - git add -A $file - fi -done - -git commit -a -m "Sync docs from master to gh-pages" - -# Uncomment the following push if you want to auto push to -# the gh-pages branch whenever you commit to master locally. -# This is a little extreme. Use with care! -################################################################### -git push origin gh-pages - -# Finally, switch back to the master branch and exit block -git checkout master -if [ "$dirty" != "0" ]; then git stash pop; fi - -exit 0 diff --git a/spring-cloud-cloudfoundry-discovery/src/main/asciidoc/intro.adoc b/spring-cloud-cloudfoundry-discovery/src/main/asciidoc/intro.adoc deleted file mode 100644 index 913ef7b..0000000 --- a/spring-cloud-cloudfoundry-discovery/src/main/asciidoc/intro.adoc +++ /dev/null @@ -1,15 +0,0 @@ -Spring Cloud for Cloudfoundry makes it easy to run -https://github.com/spring-cloud[Spring Cloud] apps in -https://github.com/cloudfoundry[Cloud Foundry] (the Platform as a -Service). Cloud Foundry has the notion of a "service", which is -middlware that you "bind" to an app, essentially providing it with an -environment variable containing credentials (e.g. the location and -username to use for the service). - -Add this project as a dependency to any Spring Cloud UI app or REST -service and deploy to Cloudfoundry. If you use Spring Cloud Security -OAuth2 features this will make them bindable to Cloud Foundry services -instead of enironment properties in `spring.oauth2.*`. For a UI app you can -declare `@EnableOAuth2Sso` and bind to a service called "sso", and for -a service you can add `@EnableOAuth2Resource` and bind to a service -called "resource" (see below for how to change the names). diff --git a/spring-cloud-cloudfoundry-discovery/src/main/asciidoc/quickstart.adoc b/spring-cloud-cloudfoundry-discovery/src/main/asciidoc/quickstart.adoc deleted file mode 100644 index d08fca6..0000000 --- a/spring-cloud-cloudfoundry-discovery/src/main/asciidoc/quickstart.adoc +++ /dev/null @@ -1,50 +0,0 @@ -Here's a Spring Cloud app with OAuth2 SSO: - -.app.groovy -[source,java] ----- -@Controller -@EnableOAuth2Sso -class Application { - - @RequestMapping('/') - String home() { - 'Hello World' - } - -} ----- - -If you run it without any service bindings: - ----- -$ spring jar app.jar app.groovy -$ cf push -p app.jar ----- - -it will be secure with (Spring Boot default) Basic authentication, -i.e. the password will be in the logs (or set it with -`security.user.password` as normal). To turn on OAuth2 SSO all you -need to do is bind the app to a service with the right -credentials. For example, a -http://docs.pivotal.io/pivotalcf/devguide/services/user-provided.html[user-provided -service] can be created like this on PWS: - ----- -$ cf create-user-provided-service sso -p '{clientId:"",clientSecret:"",userInfoUri:"https://uaa.run.pivotal.io/userinfo",tokenUri: "https://login.run.pivotal.io/oauth/token",authorizationUri:"https://login.run.pivotal.io/oauth/authorize"} ----- - -Then bind and restart the app: - ----- -$ cf bind app sso -$ cf restart app ----- - -and visit it in a browser. It will redirect to the Cloud Foundry (PWS) -login server instead of challenging for Basic authentication. The -`clientId` and `clientSecret` are credentials of a registered client -in Cloud Foundry. To get a Cloud Foundry client registration for -testing please ask your local platform administrator if it's a private -instance). - diff --git a/spring-cloud-cloudfoundry-discovery/src/main/asciidoc/spring-cloud-cloudfoundry.adoc b/spring-cloud-cloudfoundry-discovery/src/main/asciidoc/spring-cloud-cloudfoundry.adoc deleted file mode 100644 index 8faa3b5..0000000 --- a/spring-cloud-cloudfoundry-discovery/src/main/asciidoc/spring-cloud-cloudfoundry.adoc +++ /dev/null @@ -1,75 +0,0 @@ -= Spring Cloud for Cloud Foundry - -include::intro.adoc[] - -== Quickstart - -include::quickstart.adoc[] - -== How Does it Work? - -=== OAuth2 Single Sign On - -Spring Cloud Security provides the `@EnableOAuth2Sso` annotation and -binds the app to environment properties in `spring.oauth2.\*`. Spring Cloud -for Cloud Foundry just sets up default environment properties so that -it all just works if you bind to a Cloud Foundry service instance -called "sso". The service credentials are mapped to the SSO -properties, i.e. (from `spring.oauth2.client.*`) `clientId`, `clientSecret`, -`tokenUri`, `authorizationUri`, (and from `spring.oauth2.resource.*`) -`userInfoUri`, `tokenInfoUri`, `keyValue`, `keyUri`. Refer to the -Spring Cloud Security documentation for details of which combinations -will work together. The main thing is that in Cloud Foundry you only -need one service to cover all the necessary credentials. - -To use a different service instance name (i.e. not "sso") just set -`spring.oauth2.sso.serviceId` to your custom name. - -=== JWT Tokens - -Spring Cloud Security already has support for decoding JWT tokens if -you just provide the verification key (as an environment property). In -Cloud Foundry you can pick that property up from a service binding -(`keyValue` or `keyUri`). - -For example the `keyUri` in PWS is -"https://uaa.run.pivotal.io/token_key": - ----- -$ curl https://uaa.run.pivotal.io/token_key -{"alg":"SHA256withRSA","value":"-----BEGIN PUBLIC KEY-----\nMIIBI...\n-----END PUBLIC KEY-----\n"}d ----- - -=== OAuth2 Resource Server - -Similarly, the `@EnableOAuth2Resource` annotation will protect your -API endpoints if you bind to a service instance called "resource". -The "sso" service above will work for a resource server as well (so -just bind to that if it's there). If the OAuth2 tokens are JWTs (as in -Cloud Foundry), it is common to use a separate service for resources -to avoid a network round trip decoding the token on every access. A -user-provided-service for an OAuth2 resource can be created like this -on PWS: - ----- -$ cf create-user-provided-service resource -p '{keyUri:"https://uaa.run.pivotal.io/token_key"} ----- - -To use JWT you need to add the verification key as either -`keyValue` or `keyUri` (these could be added to the "sso" -service or the "resource" service if you have one). - -To use a different sercice instance name (i.e. not "resource" or -"sso") just set `spring.oauth2.resource.serviceId` to your custom name. - -=== Default Environment Keys - -The precise mapppings are as follows: - -* `spring.oauth2.sso.\*` to `vcap.services.${spring.oauth2.sso.serviceId:sso}.credentials.*` - -* `spring.oauth2.client.\*` to `vcap.services.${spring.oauth2.sso.serviceId:sso}.credentials.tokenUri:${vcap.services.${spring.oauth2.resource.serviceId:resource}.credentials.*` - -* `spring.oauth2.resource.(jwt).\*` to `vcap.services.${spring.oauth2.resource.serviceId:resource}.credentials.tokenUri:${vcap.services.${spring.oauth2.sso.serviceId:sso}.credentials.*` - - diff --git a/spring-cloud-cloudfoundry-discovery/src/main/ruby/generate_readme.sh b/spring-cloud-cloudfoundry-discovery/src/main/ruby/generate_readme.sh deleted file mode 100755 index fc5b7f1..0000000 --- a/spring-cloud-cloudfoundry-discovery/src/main/ruby/generate_readme.sh +++ /dev/null @@ -1,30 +0,0 @@ -#!/usr/bin/env ruby - -base_dir = File.join(File.dirname(__FILE__),'../../..') -src_dir = File.join(base_dir, "/src/main/asciidoc") -require 'asciidoctor' -require 'optparse' - -options = {} -file = "#{src_dir}/README.adoc" - -OptionParser.new do |o| - o.on('-o OUTPUT_FILE', 'Output file (default is stdout)') { |file| options[:to_file] = file unless file=='-' } - o.on('-h', '--help') { puts o; exit } - o.parse! -end - -file = ARGV[0] if ARGV.length>0 - -srcDir = File.dirname(file) -out = "// Do not edit this file (e.g. go instead to src/main/asciidoc)\n\n" -doc = Asciidoctor.load_file file, safe: :safe, parse: false -out << doc.reader.read - -unless options[:to_file] - puts out -else - File.open(options[:to_file],'w+') do |file| - file.write(out) - end -end